4 ms·
> I don't see how this is so hard: just let us download the CRLs Previously, you couldn't do this, because not all CAs published CRLs. Beginning October 1, yo
by agwa 4y ago
> I don't see how this is so hard: just let us download the CRLs
Previously, you couldn't do this, because not all CAs published CRLs.
Beginning October 1, you will be able to just download the CRLs, because Apple and Mozilla are requiring it.
It's therefore unclear what your beef is,
- ok_dad 4y ago> Beginning October 1, you will be able to just download the CRLs Correction: Apple and Mozilla will be able to just download the CRLs. Not me. The link in the post SPECIFICALLY says us common plebes don't get that right.
- agwa 4y agoWhere does the post say that? If you think it's because the URLs will be disclosed in the CCADB, note that the contents of the CCADB are published here: https://www.ccadb.org/resources https://www.ccadb.org/resources Specifically, the CRL URLs can be found in this CSV file: http://ccadb-public.secure.force.com/ccadb/AllCertificateRecordsCSVFormat http://ccadb-public.secure.force.com/ccadb/AllCertificateRec...
- ok_dad 4y agoI was pretty sure this section meant what I said but maybe you can get them from that database without being a BigCo?: “Our new CRL URLs will be disclosed only in CCADB, so that the Apple and Mozilla root programs can consume them without exposing them to potentially large download traffic from the rest of the internet at large.”
- chrisfosterelli 4y agoI assumed what they meant is that the database is publicly available but that browser implementations won't be directly pulling CRLs. Instead the browser providers pull the CRLs and create a compressed version that their browser users download. In the same way that you can technically query the DNS root servers yourself but you don't tend to do that because your computer will query a more downstream DNS server.
- agwa 4y agoYes, that's exactly what it means.
- agwa 4y agoI have a cron job that pulls that CSV file once a day. I assure you I am not a BigCo.
- ok_dad 4y agoI was wrong, thanks for correcting me :)
- mholt 4y ago"The connection has timed out. An error occurred during a connection to ccadb-public.secure.force.com."
- agwa 4y agoWorks for me, though the time to first byte is currently rather long.